Company & research brief
Cordon Security
AI security consulting by Bill, using ARES.
Purpose
Cordon Security tests LLM applications and AI agents for prompt injection, unsafe tool use, and authorization failures. ARES generates and adapts attacks, checks results, and records the run. For client work, Bill approves execution and reviews every reported finding.
History
Bill began developing ARES in December 2025. Cordon Security began operating in March 2026 as a consulting practice of Compass Point Ventures LLC.
Core work
- LLM and AI-agent red teaming
- Indirect prompt-injection testing
- Tool and authorization testing
- Exploit validation
- Remediation and retesting
Operating boundaries
- Owned labs or targets covered by written authorization
- Defined test window and stop conditions
- Execution controlled by Bill
- No resale or proxying of restricted model access
- Raw attack material kept private
Research record
Model testing: ARES-generated attacks produced confirmed breaks on at least 15 of the 25 distinct models Bill tested. Tasks and attempt budgets varied, so the figure reports model coverage only.
IPI benchmark: one model-backed synthetic test completed 36/36 legitimate tasks, recorded 72 accepted and zero rejected tool actions, confirmed 0/12 attack successes, and produced 0/24 control false positives.
Four-scenario suite: four synthetic indirect-prompt-injection scenarios are implemented and pass mock validation. Model-backed results for the full suite have not been run.
How results are checked
- Model scores rank candidates but do not confirm a break.
- A test must produce the required action or state change.
- Invalid and rejected actions do not count.
- Control cases check for false positives.
- Published benchmark runs record models, settings, actions, tokens, timing, and known limits.
Current readiness
ARES is an internal research tool. Bill operates Cordon Security assessments. Network automation remains limited to lab testing.
Restricted model access
Internal research: if approved, Bill will use restricted models only in Compass Point Ventures LLC’s approved workspace. Access will not be shared with clients.
Client work: Cordon Security will use restricted models for client work only after OpenAI separately approves that use. Bill remains the operator; the client receives a report, not model access.
Cordon Security is not affiliated with OpenAI. Daybreak is mentioned only to describe intended use if access is approved.